Remote Heap-Based Buffer Overflow in Kamailio CDP Diameter Receiver

Kamailio is vulnerable to a heap-based buffer overflow within the CDP Diameter Receiver component, specifically impacting the shm_malloc function located in 'src/modules/cdp/receiver.c'. This vulnerability, identified as CVE-2026-93962, affects Kamailio versions up to 5.8.8, 6.0.7, 6.1.4, and 6.2.0-dev1. An unauthenticated remote attacker can exploit this flaw by sending specially crafted Diameter protocol messages to the receiver, leading to heap memory corruption. Publicly available exploit code has been reported, increasing the risk of active exploitation. Defenders should prioritize patching, as the vulnerability resides in core signaling handling components often exposed to network traffic. Successful exploitation could result in service instability or remote code execution, depending on the memory layout and attacker control over the overflowed data.

Impact

The vulnerability poses a high risk to telecommunications and VoIP infrastructure relying on Kamailio for Diameter signaling. A successful exploit can lead to unauthorized code execution, allowing for lateral movement within the network, or persistent denial of service by crashing the process. Given the public availability of exploit code, any internet-facing or unsegmented Kamailio instance is at immediate risk of compromise.

Recommendation

• Upgrade Kamailio to version 6.0.8 or the latest stable releases (>= 5.8.9, >= 6.0.8, >= 6.1.5, >= 6.2.0-dev2) which contain the official patches for CVE-2026-93962.
• Apply the vendor-provided patch (38711a3e788de0130d48cb485578c482b57d9351) if a full version upgrade is not immediately feasible.
• Implement strict network segmentation and access control lists (ACLs) to limit access to the Diameter signaling port (typically 3868) to only known, authorized peers.
• Monitor Kamailio process logs for frequent unexpected restarts or segment faults (SIGSEGV), which may indicate exploitation attempts or service crashes.